CVE-2026-65828CWE-862broken-access-control

CVE-2026-65828

published September 25, 2026

CVSS
2.3
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.

The record
Technical detail
CVSS
2.3 · NONE
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00204 · 9.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-25T22:17Z
References (2)
https://github.com/zammad/zammad/commit/3b755736fdbee8ff6ddf53661d6912d3d3028325 · [email protected]https://github.com/zammad/zammad/security/advisories/GHSA-x4f3-367g-m93g · [email protected]
EPSS history
Timeline
  • 27 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 17:28Z
    Zammad: Pending upload deletion bypass via legacy attachment endpoint
    cvelistv5